airflow-toolkit (0.13.3), airflow-tools (>=0.9.0, <=0.12.0) +4 more potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (>=9.0.0, <=9.30.0)

apache-airflow-providers-amazon PYPI version =9.0.0, =0.9.0, =0.0.1, =2.10.3, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-68872 Source advisory: SNYK:PYTHON-APACHEAIRFLOWPROVIDERSAMAZON-18609774...

Authorization Bypass Through User-Controlled Key

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the SecretsManagerBackend and SystemsManagerParameterStoreBackend...

example-pkg-naturalett (>=14.4.0, <=14.4.8) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (2.0.0)

apache-airflow-providers-amazon PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.8 Source cves: CVE-2026-68872 Source advisory:...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-68872 Source advisory: OSV:PYSEC-2026-371...

airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (8.29.0)

apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-68872 Source advisory:...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-688...

airflow-poetry-test (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (3.4.0)

apache-airflow-providers-amazon PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-poetry-test =0.1.0, =0.1.2 Source cves: CVE-2026-68872 Source advisory: OSV:PYSEC-2026-371...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2026-68872 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2026-68872 Source advisory: OSV:PYSEC-2026-3713...

PT-2026-69898

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.34.0 Description The AWS Systems Manager Parameter Store and Secrets Manager backends in the Amazon provider resolve a team-scoped Connection or Variable id through a team-agnostic lookup if...

airgoodies (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (8.7.1)

apache-airflow-providers-amazon PYPI version 8.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airgoodies =0.0.3, =0.0.4 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-2363...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-256...

airflow-providers (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (5.1.0)

apache-airflow-providers-amazon PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-providers =0.1.0, =0.3.0 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-2363...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-2363...

example-pkg-naturalett (>=14.4.0, <=14.4.8) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (2.0.0)

apache-airflow-providers-amazon PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.8 Source cves: CVE-2026-25604 Source advisory:...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-25604 Source advisory: OSV:PYSEC-2026-236...

airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (8.29.0)

apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-25604 Source advisory:...

airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (8.29.0)

apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-42526 Source advisory:...

airflow-toolkit (0.13.3), airflow-tools (>=0.9.0, <=0.12.0) +4 more potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (>=9.0.0, <=9.17.0)

apache-airflow-providers-amazon PYPI version =9.0.0, =0.9.0, =0.0.1, =2.10.3, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-42526 Source advisory: OSV:GHSA-G9QC-QF28-HHQX...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-42526 Source advisory:...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2026-42526 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2026-42526 Source advisory: OSV:GHSA-G9QC-QF28-HHQ...